Online security
By Guy Clapperton, 9th January 2008 at 12:57 pm
Here’s a laugh to start the year off. Jeremy Clarkson, whom God preserve, has been slating the security freaks - his view is that the Government’s loss of data was nothing to worry about. He said it in his column in the Sun newspaper, and so confident was he that he…giggle…published his bank details. You hand them over to anyone to whom you send a cheque, he argued, so there couldn’t be a problem.
Except a reader decided to prove him wrong, which is why he now has egg all over his face following an unintentional donation to a diabetes charity. They went in, they helped themselves and he’s now uncharacteristically humble.
Which is an amusing story as it stands but it does raise some interesting issues as a press list in which I take part has pointed out. First, surely all banks are bound to reverse payments if the payer complains and they are not signed for? Recovering the money should have been simple. Second, aren’t direct debits supposed to get confirmed in writing by the bank - and according to the rules (which aren’t always obeyed) aren’t they supposed to remain unenacted for ten days precisely so that someone can quibble over whether they want them any more?
The Clarkson thing is an entertaining story on the surface. It’s always fun to see the terminally arrogant getting taken down a bit, rather like Gordon Ramsay being caught not catching a fish. The underlying story, though, is that a bank isn’t doing its job - and that’s a rather more unsettling start to 2008.
Related Posts
Posted in the following topics: Small Business | 
| 
TrackBack address
More business podcasts
More blogs
More news
That was a funny story. It’s a bit scary that someone can open up a direct debit on your behalf that easily though.
Comment by Phil Connolly — January 9, 2008 #
The DD thing is disturbing. Presumably though it required a forged signature. Strictly speaking a criminal offence, in which case you’re protected.
Problem is for Clarkson, however, that most bank Ts&Cs, as far as I’m aware, offer you protection from fraud ‘unless you’ve been negligent with your bank details’. Perhaps in this case Barclays considers publishing details in The Sun as less than careful! Having said that I don’t suppose he’s asked for the money back.
Anyway, the negligence thing is a side issue. If HMRC has been negligent with your bank details and a fraud happens … yes, the consumer or small business is protected and any transaction should be reversed.
[disclaimer 1: I used to work in corp comms for various banks. disclaimer 2: challenge me if my memory of the above proves wrong or facts have changed!
Comment by Alex Bellinger — January 9, 2008 #
The story as reported by the papers is very poorly written or Clarkson has been very poorly advised.
Becoming a direct debit originator like this charity is not a trivial process. You have to be sponsored by your own bankers who are effectively guaranteeing your ability to repay, on demand, any direct debit that is refuted by the payer. So Clarkson just tells his bank that it wasn’t him, his bank refund him - immediately - and get the money back from the originator. Hopefully the originator then informs the police of the details of te fraud and the prankster is pursued by the full weight and force of the law.
The process of setting up direct debits has lots of safeguards and it looks like lots of them were not followed. But regardless of those failures, this money has not been stolen, it’s just been moved somewhere that it wasn’t expected for a short period of time and can be moved back instantly.
Sadly, I expect that this wasn’t the way the story was reported because it is less easy to scare people with “Nothing really happened here” and scaring people is what the news media exists for.
[disclaimer : I use to work for a software firm that handled about 20-30% of all direct debit transactions that take place in the UK and spent what feels like half my life dealing with the direct debit system in a lot more detail than I would have liked]
Comment by Ian — January 10, 2008 #
@Ian - it is a little more serious than that. Direct debit forms are relatively simple, with not many security safeguards (take a look at one and see how easy it is to obtain the information on there). In this instance, the transfer was to a charity, but what if the transfer had been to an account that had the money withdrawn and was closed. The incident raises some serious questions. I note that, for once, the Internet didn’t get the blame! Anyway, it is disturbing for both individuals and businesses.
Comment by Benjamin — January 13, 2008 #
Sorry Benjamin but it isn’t “a little more serious that that”. You don’t get to be a direct debit originator that easily. If you think you do then tell your bank that you would like to start originating DD’s and come back in 3-6 months and tell us how far through the process you have got. Even if the originator has vanished in a puff of smoke the originators bank carries the liability anyway so Clarkson still gets his money back. Being foolish with bank details is foolish but being terrified aboyt them is also foolish.
Comment by Ian — January 13, 2008 #
Hi Ian. 3-6 months is a very small time frame in some of the fraud cases I have seen, but you are right, we shouldn’t be terrified, but we should certainly be more cautious than Clarkson was. Like many of us, he thought that you couldn’t do anything harmful with bank details. Has there been any clarification about him getting his money back? He was giving the impression that he hadn’t, although that bit is only part of the story of course.
Comment by Benjamin — January 14, 2008 #
Here’s a scenario which happened to me when setting up a new insurance policy:
Call Centre: Would you like to pay your premiums by DD?
Me: Yes.
Call Centre: OK, I can either send you something to sign through the post or explain the details over the phone and get your agreement now.
Me: Fine, let’s do it over the phone.
Call Centre: We’ll send you the DD agreement.
Needless to say I’ve never seen the DD agreement slip. The above does show that it might be possible to ask a DD originator to set up details over the phone, with a few bank and address details.
Comment by Alex Bellinger — January 14, 2008 #
3-6 months is how long the process is likely to take. You would have had to have had a relationship with your sponsoring bank of some sort for longer than that or have a undoubted reputation. And yes - it is very easy to set up DD payments on the phone - that is what makes them a great way to bring efficiency to the payments system. And that efficiency is why it is important to try and paint a whole and entire picture of the DD system in this instance.
Has Clarkson got his money back? Unless he chooses to tell us I cannot imagine that any other element of the media will. You see, telling us that piece of information would act in such a way as to reduce hysteria which plainly is not in the interests of anybody concerned.
Comment by Ian — January 14, 2008 #
Since the money went to charity, I doubt Clarkson would have asked for it back.
You’re right though, Ian, neither Clarkson or The Sun is likely to take their foot of the hysteria pedal
Comment by Alex Bellinger — January 14, 2008 #